php - Should uploaded files be renamed? -

i've been reading on php file upload security , few articles have recommended renaming files. example, owasp article unrestricted file upload says:

it recommended use algorithm determine filenames. instance, filename can md5 hash of name of file plus date of day.

if user uploads file named cake recipe.doc there reason rename 45706365b7d5b1f35?

if answer yes, whatever reason, how keep track of original file name , extension?

to primary question, practice rename files, answer definite yes, if creating form of file repository users upload files (and filenames) of choosing, several reason:

1. security - if have poorly written application allows download of files name or through direct access (it's horrid, happens), it's harder user, whether maliciously or on purpose, "guess" names of files.
2. uniqueness -- likelihood of 2 different people uploading file of same name high (ie. avatar.gif, readme.txt, video.avi, etc). use of unique identifier decreases likelihood 2 files of same name.
3. versioning -- easier keep multiple "versions" of document using unique names. avoids need additional code parse filename make changes. simple example document.pdf document(1).pdf, becomes more complicated when don't underestimate users abilities create horrible names things.
4. length -- working known filename lengths better working unknown filename lengths. can know (my filepath) + (x letters) length, (my filepath) + (random user filename) unknown.
5. os -- length above can create problems when attempting write extremely random/long filenames drive. have account special characters, lengths , concerns trimmed filenames (user may not receive working file because extension has been trimmed).
6. execution -- it's easy os execute file named .exe, or .php, or (insert other extension). it's hard when there isn't extension.
7. url encoding -- ensuring name url safe. cake recipe.doc not url safe name, , can on systems (either server or browser side) / situations, cause inconsistencies when name should urlencoded value.

as storing information, typically in database, no different need have already, since need way refer file (who uploaded, name is, occassionally stored, time of upload, size). you're adding actual stored name of file in addition user's name file.

the owasp recommendation isn't bad 1 -- using filename , timestamp (not date) unique. take step further include microtime timestamp, , other unique bit of information, duplicate upload of small file couldn't occur in same timeframe -- store date of upload additional insurance against md5 clashes, has higher probability in systems store many files , years. incredibly unlikely generate 2 md5s, using filename , microtime, on same day. example be:

$filename = date('ymd') . '_' . md5($uploaded_filename . microtime()); 

my 2 cents.